First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2021-35503

MediumCVSS 6.1/10Last modified Jul 5, 2026

Description

Afian FileRun 2021.03.26 allows stored XSS via an HTTP X-Forwarded-For header that is mishandled when rendering Activity Logs.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://syntegris-sec.github.io/filerun-advisoryExploit, Third Party Advisory
http://blog.filerun.comProduct
https://syntegris-sec.github.io/filerun-advisoryExploit, Third Party Advisory

Timeline

Published: Oct 5, 2021
Last modified: Jul 5, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-355047.2Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the ffmpeg binary.CVE-2021-355057.2Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the magick binary.CVE-2021-355066.1Afian FileRun 2021.03.26 allows XSS when an administrator encounters a crafted document during use of the HTML Editor for a preview or edit CVE-2021-355088.8NMSAccess32.exe in TeraRecon AQNetClient 4.4.13 allows attackers to execute a malicious binary with SYSTEM privileges via a low-privileged u CVE-2021-35517.8A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log fi CVE-2021-355126.5An SSRF issue was discovered in Zoho ManageEngine Applications Manager build 15200.CVE-2021-355136.1Mermaid before 8.11.0 allows XSS when the antiscript feature is used.CVE-2021-355149.8Narou (aka Narou.rb) before 3.8.0 allows Ruby Code Injection via the title name or author name of a novel.CVE-2021-355157.5When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop.CVE-2021-355167.5When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory CVE-2021-355177.5When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memor CVE-2021-35527.5A Server-Side Request Forgery (SSRF) vulnerability in the EPPUpdateService component of Bitdefender Endpoint Security Tools allows an attack